How many of you still have Java installed?

[AlanJohn]

I still have Java enabled in Chrome.
Fuck the police.

 

[CrimzonEyed]

Hmm Seems lik I have it, but I didn't know I did. I came pre-installed with Chakra.

 

[gifi4]

How risky is it to keep it installed? Is it malware that will completely prevent me from accessing my pc or malware that I can get rid of in simple measures (Scans, safe mode scans, searching of the process running etc.)?

 

[FAST6191]

The payload seen out in the wild is not that bad it would seem but it is arbitrary code execution so if paired with something nasty then yeah it could be a system killer (not that anybody makes system killer malware any more) or something really hard to remove.
Options other than uninstalling it probably sit as disable it in browser, whitelist the sites that require it in browser ( http://noscript.net/ being a good tool for it*) and keep UAC on and/or running at a low privilege user. This said the article says that it need not be java applets that initiate the attack vector so I am not sure how that plays out as far as whitelisting goes which is incredibly scary if so as whitelisting usually means security is down to "user at fault" or "exploit within whitelisted application" level.

*noscript is an awesome tool but like any whitelisting (or blacklisting) tool it can be a right pain if you are not used to whitelisting tools and many sites are still badly coded and need javascript to run at all let alone with extra features. I highly recommend learning/using the full setup that allows things on a case by case basis but you can set it to just block java and flash objects until you click on them to activate them if you prefer (Use "allow scripts globally" and in the options make sure apply these restrictions to whitelisted sites is checked along with the object blocks in the embeddings tab).

As for OpenJDK I have no idea- I imagine the problems come if it includes a browser addon and in whatever standalone runtime it uses.

Edit- clarification in the noscript section.

 

[Deleted-185407]

The only time I ever use Java personally is when I want to quickly write some random application. There's been plenty of situations where I coded a Java application to check if one of my college assignment answers was correct, or when I just wanted to try something as a proof of concept. Why go through the hassle of using C++ or C# when Java is so much more easier to get something working in? Other than that, I don't think I use any applications other than Eclipse that uses Java.

Software companies still love using Java however, because Java is a skill the majority of software developers have (due to being a very easy language), while also being cross-platform. Customers can run Java applications on Unix, Linux, Windows, Mac and so on, and will all have the exact same experience, which drastically cuts down on development costs. Java libraries and IDEs are also very powerful, which also is very attractive for developers since the majority of functionality you'll need is already there for you to work with.

As for this security issue, at least for the company I work in, everyone has to stick to the one version, which is 1.6 at the moment. There's no plans to upgrade to 1.7 at all, and I'll say this recent issue would definitely hold any upgrade plans back. Not to mention, there's no real major reason yet to upgrade. As for my personal usage, I don't have any reason to upgrade either.

 

[Arras]

The payload seen out in the wild is not that bad it would seem but it is arbitrary code execution so if paired with something nasty then yeah it could be a system killer (not that anybody makes system killer malware any more) or something really hard to remove.
Options other than uninstalling it probably sit as disable it in browser, whitelist the sites that require it in browser ( http://noscript.net/ being a good tool for it*) and keep UAC on and/or running at a low privilege user. This said the article says that it need not be java applets that initiate the attack vector so I am not sure how that plays out as far as whitelisting goes which is incredibly scary if so as whitelisting usually means security is down to "user at fault" or "exploit within whitelisted application" level.

*noscript is an awesome tool but like any whitelisting (or blacklisting) tool it can be a right pain if you are not used to whitelisting tools and many sites are still badly coded and need javascript to run at all let alone with extra features. I highly recommend learning/using the full setup but you can set it to block java and flash objects unless you click on them to activate them if you prefer (allow on all sites and in the options make sure apply these restrictions to whitelisted sites is checked).

As for OpenJDK I have no idea- I imagine the problems come if it includes a browser addon and in whatever standalone runtime it uses.

NoScript is pretty easy to set up. Just select Allow Scripts Globally (dangerous), go to settings, make sure Java blocking is enabled (you might want to disable audio/video and Flash blocking or Youtube won't work) and set it to Apply these restrictions on whitelisted sites. If you want to run a java applet, just click the applet and select Allow.

 

[Ghostyis40]

I do cause I use it and its needed from time to time!

 

[SifJar]

NoScript is pretty easy to set up. Just select Allow Scripts Globally (dangerous), go to settings, make sure Java blocking is enabled (you might want to disable audio/video and Flash blocking or Youtube won't work) and set it to Apply these restrictions on whitelisted sites. If you want to run a java applet, just click the applet and select Allow.

He meant it is a pain to set up properly.

 

[BoxmanWTF]

I have it so I can use certain sites that need the java add on

 

[Arras]

NoScript is pretty easy to set up. Just select Allow Scripts Globally (dangerous), go to settings, make sure Java blocking is enabled (you might want to disable audio/video and Flash blocking or Youtube won't work) and set it to Apply these restrictions on whitelisted sites. If you want to run a java applet, just click the applet and select Allow.

He meant it is a pain to set up properly.

Actually, I think he meant it is a pain to use because you have to select "Allow" every time you visit a page that needs Javascript. If you set it up like I said you don't have to do that.

 

[FAST6191]

C# vs Java...... cross platform is a given for even with mono and moma I am not sure about C# to say nothing of all the things not cross platform built on top of "plain" C# but as a straight up rapid development language (even with all those data types and existing libraries) I am not so sure. Beyond that (especially with the active interpreter stuff) then for my money python has just about edged it out, however we are probably dealing is personal preference at this point and I would have a really hard time arguing Java is not worth the effort; I certainly would not commission a program in Java today and other than they want to fix legacy code (nowhere near as lucrative as old flavours of C and the likes of COBOL) I am not sure I would even suggest people learn Java, although part of that seems to be that Oracle seem intent on driving it into the ground.

As for companies- I agree entirely that it is well entrenched in the corporate world and what IT work I do I am truly thankful I do not have to fight with it or even really consider it. The worst for me comes when it is not necessarily a major version but a minor version/update that has be stuck with for some random application that naturally is business critical (usually because of LDAP and workarounds to workarounds but not always).

Centrix - from time to time is fine but one would surely have to ponder if having the ability to do so on rare occasion is worth having the potential security hole.

Edit- Re: the noscript discussion. I agree you can set up basic blacklisting and object blocking easily enough but to maintain it is troublesome not to mention it has a nasty habit of reverting a setting or two when updating and even on "allow everything" mode there have been some hassles even there. To this end as much as I want to I do not install noscript on every machine I get to spruce up and will instead opt for ghostery, greasemonkey plus choice scripts and adblock and take my chances down the road which is what informed my "do it but expect a few hassles" mindset when I suggested it as a possibility for gifi4. Personally I do not mind whitelisting things (I also have requestpolicy and blitzableiter on top of everything else) but for the "just works" crowd, which is quite justifiably most people out there, I can see and have seen noscript cause hassle.

 

[Rydian]

Java and Javascript aren't the same thing. While Noscript is primarily meant to stop javascript, he's talking about using it to stop Java.

 

[Originality]

Fun fact, JavaScript was originally called LiveScript. It only got renamed due to the popularity of Java (and a co-marketing deal with Sun Microsystems) when Netscape first implemented support for Java runtimes within its browser.

 

[YoshiInAVoid]

I have Java installed because the commercial is so epic:

http://www.youtube.com/watch?v=FiRZwBX3wZo

 

[Sicklyboy]

Minecraft client and server.

 

[Dingoo-fan 32]

To tell the truth, i'm not sure.

 

[FAST6191]

Many months on bump.
The subsequent months finally saw clients need nasty legacy versions of java installed, configured and whatever else for proper programs that they need to make money but the other day I was asked for a basic 2d room planner and naturally I arrived at sweethome 3d. Seeing java my heart sank but to my shock it came with a portable version ( http://sourceforge.net/projects/swe...me3D-4.0/SweetHome3D-4.0-portable.7z/download ) that basically just added a couple of hundred megs to the extracted size (most of which I could probably trim if I cared). Also http://portableapps.com/apps/utilities/java_portable I guess.

Now if somebody would be kind enough to pull flash's life support then things would be much better.

 

[Smuff]

I uninstalled Java because

1. I'm a sheep

and

2. I don't play Minecraft

 

[YayMii]

I have Java installed because I play NullpoMino. :|

 

[3bbb7]

I have it installed but it's disabled on browsers. also I have malwarebytes pro, and so thats just extra precaution against 0day exploits.